How to open a .PCAP file online
Three steps, a few seconds.
Open your .PCAP file
Drop it on the box or click to choose it. It opens.
Filter the packets
Type dns, http, tls, an IP address or port 443 - or click a quick filter. Click any packet to see its layers and raw bytes.
Read the summary
The Insights tab lists name lookups, web requests and secure-connection server names; Statistics shows protocols, top conversations and a timeline.
What is a .PCAP file?
The universal format for recorded network traffic.
A .pcap file is a recorded snapshot of network traffic captured by a tool such as Wireshark or tcpdump. Open it in Wireshark (free, Windows/macOS/Linux); it decodes every protocol layer automatically. Be aware that captures can contain sensitive data like passwords and session cookies, so treat them as confidential.
Programs that open .PCAP files
| Full name | Packet Capture (libpcap) File |
|---|---|
| Developer | tcpdump/libpcap project (de-facto standard); used by Wireshark and most sniffers |
| First released | Early 1990s (libpcap/tcpdump); IETF draft standard for the on-disk format |
| Category | Data & Other |
| MIME type | application/vnd.tcpdump.pcap |
| Signature | D4 C3 B2 A1 (libpcap magic (little-endian); big-endian variant is A1 B2 C3 D4) |
Related viewers
Other free tools to open and preview your files.
Frequently asked questions
Is my .PCAP file uploaded?
No. Your .PCAP file is decoded by JavaScript in the page. Captures often contain private traffic.
Can it decrypt HTTPS / TLS traffic?
No - encrypted traffic stays encrypted. You can still see the server name each connection asked for (SNI), the TLS version and how much data was exchanged.
Which filters can I use?
Protocol names (dns, http, tls, tcp, udp, arp, icmp, ipv6), an IP address, port 53, or any text from the Info column. Combine words to narrow down - all of them must match.
How big can the file be?
Up to about 150 MB in the online version. For bigger captures, split them with editcap -c 100000 or use Wireshark.
My .cap file doesn't open. Why?
Several tools use .cap for their own formats (Microsoft Network Monitor, NetScout Sniffer). The viewer reads libpcap and pcapng; it tells you if the file is something else.
Was this tool helpful?
Your rating helps us decide which tools to improve next.